<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
<generator>
<oval:product_name>Oracle Errata System</oval:product_name>
<oval:product_version>Oracle Linux</oval:product_version>
<oval:schema_version>5.11</oval:schema_version>
<oval:timestamp>2026-10-26T21:57:46</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.oracle.elsa:def:202689756" version="501" class="patch">
<metadata>
<title>
ELSA-2026-89756:  firefox security, bug fix, and enhancement update (IMPORTANT)
</title>
<affected family="unix">
<platform>Oracle Linux 8</platform>

</affected>
<reference source="elsa" ref_id="ELSA-2026-89756" ref_url="https://linux.oracle.com/errata/ELSA-2026-89756.html"/>
<reference source="CVE" ref_id="CVE-2026-109704" ref_url="https://linux.oracle.com/cve/CVE-2026-109704.html"/>
<reference source="CVE" ref_id="CVE-2026-109705" ref_url="https://linux.oracle.com/cve/CVE-2026-109705.html"/>
<reference source="CVE" ref_id="CVE-2026-109706" ref_url="https://linux.oracle.com/cve/CVE-2026-109706.html"/>
<reference source="CVE" ref_id="CVE-2026-109707" ref_url="https://linux.oracle.com/cve/CVE-2026-109707.html"/>
<reference source="CVE" ref_id="CVE-2026-109708" ref_url="https://linux.oracle.com/cve/CVE-2026-109708.html"/>
<reference source="CVE" ref_id="CVE-2026-109709" ref_url="https://linux.oracle.com/cve/CVE-2026-109709.html"/>
<reference source="CVE" ref_id="CVE-2026-109711" ref_url="https://linux.oracle.com/cve/CVE-2026-109711.html"/>
<reference source="CVE" ref_id="CVE-2026-109712" ref_url="https://linux.oracle.com/cve/CVE-2026-109712.html"/>
<reference source="CVE" ref_id="CVE-2026-109713" ref_url="https://linux.oracle.com/cve/CVE-2026-109713.html"/>
<reference source="CVE" ref_id="CVE-2026-109715" ref_url="https://linux.oracle.com/cve/CVE-2026-109715.html"/>
<reference source="CVE" ref_id="CVE-2026-109716" ref_url="https://linux.oracle.com/cve/CVE-2026-109716.html"/>
<reference source="CVE" ref_id="CVE-2026-109717" ref_url="https://linux.oracle.com/cve/CVE-2026-109717.html"/>
<reference source="CVE" ref_id="CVE-2026-109718" ref_url="https://linux.oracle.com/cve/CVE-2026-109718.html"/>
<reference source="CVE" ref_id="CVE-2026-109719" ref_url="https://linux.oracle.com/cve/CVE-2026-109719.html"/>
<reference source="CVE" ref_id="CVE-2026-109720" ref_url="https://linux.oracle.com/cve/CVE-2026-109720.html"/>
<reference source="CVE" ref_id="CVE-2026-109721" ref_url="https://linux.oracle.com/cve/CVE-2026-109721.html"/>
<reference source="CVE" ref_id="CVE-2026-109722" ref_url="https://linux.oracle.com/cve/CVE-2026-109722.html"/>
<reference source="CVE" ref_id="CVE-2026-109723" ref_url="https://linux.oracle.com/cve/CVE-2026-109723.html"/>
<reference source="CVE" ref_id="CVE-2026-109724" ref_url="https://linux.oracle.com/cve/CVE-2026-109724.html"/>
<reference source="CVE" ref_id="CVE-2026-109725" ref_url="https://linux.oracle.com/cve/CVE-2026-109725.html"/>
<reference source="CVE" ref_id="CVE-2026-109726" ref_url="https://linux.oracle.com/cve/CVE-2026-109726.html"/>
<reference source="CVE" ref_id="CVE-2026-109727" ref_url="https://linux.oracle.com/cve/CVE-2026-109727.html"/>
<reference source="CVE" ref_id="CVE-2026-109728" ref_url="https://linux.oracle.com/cve/CVE-2026-109728.html"/>
<reference source="CVE" ref_id="CVE-2026-109729" ref_url="https://linux.oracle.com/cve/CVE-2026-109729.html"/>
<reference source="CVE" ref_id="CVE-2026-109730" ref_url="https://linux.oracle.com/cve/CVE-2026-109730.html"/>
<reference source="CVE" ref_id="CVE-2026-109732" ref_url="https://linux.oracle.com/cve/CVE-2026-109732.html"/>
<reference source="CVE" ref_id="CVE-2026-109733" ref_url="https://linux.oracle.com/cve/CVE-2026-109733.html"/>
<reference source="CVE" ref_id="CVE-2026-109736" ref_url="https://linux.oracle.com/cve/CVE-2026-109736.html"/>
<reference source="CVE" ref_id="CVE-2026-109737" ref_url="https://linux.oracle.com/cve/CVE-2026-109737.html"/>
<reference source="CVE" ref_id="CVE-2026-109738" ref_url="https://linux.oracle.com/cve/CVE-2026-109738.html"/>
<reference source="CVE" ref_id="CVE-2026-109740" ref_url="https://linux.oracle.com/cve/CVE-2026-109740.html"/>
<reference source="CVE" ref_id="CVE-2026-109741" ref_url="https://linux.oracle.com/cve/CVE-2026-109741.html"/>
<reference source="CVE" ref_id="CVE-2026-109742" ref_url="https://linux.oracle.com/cve/CVE-2026-109742.html"/>
<reference source="CVE" ref_id="CVE-2026-109743" ref_url="https://linux.oracle.com/cve/CVE-2026-109743.html"/>
<reference source="CVE" ref_id="CVE-2026-109744" ref_url="https://linux.oracle.com/cve/CVE-2026-109744.html"/>
<reference source="CVE" ref_id="CVE-2026-109745" ref_url="https://linux.oracle.com/cve/CVE-2026-109745.html"/>
<reference source="CVE" ref_id="CVE-2026-109751" ref_url="https://linux.oracle.com/cve/CVE-2026-109751.html"/>
<reference source="CVE" ref_id="CVE-2026-109752" ref_url="https://linux.oracle.com/cve/CVE-2026-109752.html"/>
<reference source="CVE" ref_id="CVE-2026-109753" ref_url="https://linux.oracle.com/cve/CVE-2026-109753.html"/>
<reference source="CVE" ref_id="CVE-2026-109782" ref_url="https://linux.oracle.com/cve/CVE-2026-109782.html"/>
<reference source="CVE" ref_id="CVE-2026-45186" ref_url="https://linux.oracle.com/cve/CVE-2026-45186.html"/>

<description>
[153.5.0-1.0.1]
- Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]
- diable wasi_sdk to prevent build failure with newer llvm

[153.5.0]
- Add debranding patches (Mustafa Gezen)
- Add OpenELA default preferences (Louis Abel)

[153.5.0-1]
- Update to 153.5.0 ESR

[140.15.0-1]
- Update to 140.15.0 ESR

[140.14.0-1]
- Update to 140.14.0 ESR

[140.13.0-1]
- Update to 140.13.0 ESR

[140.12.0-1]
- Update to 140.12.0 ESR

[140.11.0-1]
- Update to 140.11.0 ESR

[140.10.2-1]
- Update to 140.10.2 ESR

[140.10.1-1]
- Update to 140.10.1 ESR
</description>
<!--
 ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ 
-->
<advisory>
<severity>IMPORTANT</severity>
<rights>Copyright 2026 Oracle, Inc.</rights>
<issued date="2026-10-26"/>
<cve cvss3="7.8/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109704.html" public="20261013">CVE-2026-109704</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109705.html" public="20261013">CVE-2026-109705</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109706.html" public="20261013">CVE-2026-109706</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109707.html" public="20261013">CVE-2026-109707</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109708.html" public="20261013">CVE-2026-109708</cve>
<cve cvss3="8.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" href="https://linux.oracle.com/cve/CVE-2026-109709.html" public="20261013">CVE-2026-109709</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109711.html" public="20261013">CVE-2026-109711</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109712.html" public="20261013">CVE-2026-109712</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109713.html" public="20261013">CVE-2026-109713</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109715.html" public="20261013">CVE-2026-109715</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109716.html" public="20261013">CVE-2026-109716</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109717.html" public="20261013">CVE-2026-109717</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109718.html" public="20261013">CVE-2026-109718</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109719.html" public="20261013">CVE-2026-109719</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109720.html" public="20261013">CVE-2026-109720</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109721.html" public="20261013">CVE-2026-109721</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109722.html" public="20261013">CVE-2026-109722</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109723.html" public="20261013">CVE-2026-109723</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109724.html" public="20261013">CVE-2026-109724</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109725.html" public="20261013">CVE-2026-109725</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109726.html" public="20261013">CVE-2026-109726</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109727.html" public="20261013">CVE-2026-109727</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109728.html" public="20261013">CVE-2026-109728</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109729.html" public="20261013">CVE-2026-109729</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109730.html" public="20261013">CVE-2026-109730</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109732.html" public="20261013">CVE-2026-109732</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109733.html" public="20261013">CVE-2026-109733</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" href="https://linux.oracle.com/cve/CVE-2026-109736.html" public="20261013">CVE-2026-109736</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" href="https://linux.oracle.com/cve/CVE-2026-109737.html" public="20261013">CVE-2026-109737</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109738.html" public="20261013">CVE-2026-109738</cve>
<cve cvss3="6.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" href="https://linux.oracle.com/cve/CVE-2026-109740.html" public="20261013">CVE-2026-109740</cve>
<cve cvss3="6.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" href="https://linux.oracle.com/cve/CVE-2026-109741.html" public="20261013">CVE-2026-109741</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" href="https://linux.oracle.com/cve/CVE-2026-109742.html" public="20261013">CVE-2026-109742</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109743.html" public="20261013">CVE-2026-109743</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" href="https://linux.oracle.com/cve/CVE-2026-109744.html" public="20261013">CVE-2026-109744</cve>
<cve cvss3="4.7/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N" href="https://linux.oracle.com/cve/CVE-2026-109745.html" public="20261013">CVE-2026-109745</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" href="https://linux.oracle.com/cve/CVE-2026-109751.html" public="20261013">CVE-2026-109751</cve>
<cve cvss3="8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2026-109752.html" public="20261013">CVE-2026-109752</cve>
<cve cvss3="5.4/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" href="https://linux.oracle.com/cve/CVE-2026-109753.html" public="20261013">CVE-2026-109753</cve>
<cve cvss3="4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" href="https://linux.oracle.com/cve/CVE-2026-109782.html" public="20261013">CVE-2026-109782</cve>
<cve cvss3="7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" href="https://linux.oracle.com/cve/CVE-2026-45186.html" public="20260510">CVE-2026-45186</cve>

<affected_cpe_list>
<cpe>cpe:/a:oracle:linux:8::appstream</cpe>
</affected_cpe_list>
</advisory>
</metadata>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202689756001" comment="Oracle Linux 8 is installed"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202689756002" comment="Oracle Linux arch is aarch64"/>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202689756003" comment="firefox is earlier than 0:153.5.0-1.0.1.el8_10"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202689756004" comment="firefox is signed with the Oracle Linux 8 key"/>
</criteria>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202689756005" comment="Oracle Linux arch is x86_64"/>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202689756003" comment="firefox is earlier than 0:153.5.0-1.0.1.el8_10"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202689756004" comment="firefox is signed with the Oracle Linux 8 key"/>
</criteria>
</criteria>
</criteria>
</criteria>

</definition>
</definitions>
<!--
 ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<tests>
<rpminfo_test id="oval:com.oracle.elsa:tst:202689756001"  version="501" comment="Oracle Linux 8 is installed" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202689756001" />
<state state_ref="oval:com.oracle.elsa:ste:202689756002" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202689756002"  version="501" comment="Oracle Linux arch is aarch64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202689756001" />
<state state_ref="oval:com.oracle.elsa:ste:202689756003" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202689756003"  version="501" comment="firefox is earlier than 0:153.5.0-1.0.1.el8_10" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202689756002" />
<state state_ref="oval:com.oracle.elsa:ste:202689756004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202689756004"  version="501" comment="firefox is signed with the Oracle Linux 8 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202689756002" />
<state state_ref="oval:com.oracle.elsa:ste:202689756001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202689756005"  version="501" comment="Oracle Linux arch is x86_64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202689756001" />
<state state_ref="oval:com.oracle.elsa:ste:202689756005" />
</rpminfo_test>

</tests>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ 
-->
<objects>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202689756002" version="501">
<name>firefox</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202689756001" version="501">
<name>oraclelinux-release</name>
</rpminfo_object>
</objects>
<states>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202689756001" version="501">
<signature_keyid operation="equals">82562ea9ad986da3</signature_keyid>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202689756002" version="501">
<version operation="pattern match">^8</version>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202689756003" version="501">
<arch operation="pattern match">aarch64</arch>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202689756004" version="501">
<evr datatype="evr_string" operation="less than">0:153.5.0-1.0.1.el8_10</evr>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202689756005" version="501">
<arch operation="pattern match">x86_64</arch>
</rpminfo_state>

</states>
</oval_definitions>
